PT-2022-13101 · Unknown · Go-Attestation

Nikki Vonhollen + 1 · Published 2022-02-01 · Updated 2022-07-15 · CVE-2022-0317

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions go-attestation versions prior to 0.4.0

Description The issue is caused by improper input validation in AKPublic.Verify, allowing local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot.

Recommendations For go-attestation versions prior to 0.4.0, upgrade to version 0.4.0 or above to resolve the issue. If your usage of this library verifies PCRs using multiple quotes, make sure to use the new method AKPublic.VerifyAll() instead of AKPublic.Verify.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-0317

GHSA-99CG-575X-774P

GO-2022-0294

Affected Products

Go-Attestation

References · 8

• https://osv.dev/vulnerability/GO-2022-0294 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-99cg-575x-774p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0317 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0317 · Vendor Advisory
• https://github.com/google/go-attestation/security/advisories/GHSA-99cg-575x-774p · Note
• https://github.com/google/go-attestation · Note
• https://github.com/google/go-attestation/commit/82f2c9c2c76e1d3691d17ee78116d1d93a123788 · Note
• https://pkg.go.dev/vuln/GO-2022-0294 · Note